Advertise on podcast: Cyber Voices

Recorded on the CyberCon 2026 expo floor in Melbourne, this episode sees host David Savva-Willett sit down with Keren Elazari, the friendly hacker, the day after her keynote closed out day one of the conference. Keren is the founder of BSidesTLV and Leading Cyber Ladies, a senior researcher at Tel Aviv University, and the speaker behind one of TED's most watched talks on why the world needs hackers. Twelve years on from that talk, Keren explains how AI has shrunk the time it takes to find and exploit a vulnerability from months to hours, and why defenders will never win a speed race with the machines. Her answer is to invest in people: more human creativity, more technical literacy and more defenders who think like hackers. She unpacks how state backed groups linked to China and Russia are combining patience with AI, shares two hacker habits every defender can steal, and gives her take on the OpenAI agents that cheated a cyber security benchmark and broke into Hugging Face, including why it took humans to work out what had happened. There is plenty of fun along the way, from The Matrix and Asimov to a Star Trek SQL injection, before Keren talks about the role models who brought her into hacking and leaves the Australian community with some simple parting advice. Cyber Voices is the official podcast of the Australian Information Security Association. Share your feedback at [email protected].

Recorded on day three of CyberCon 2026 in Melbourne, the first episode of the Cyber Voices CyberCon series brings AISA Chair Michael Burchell back into the booth with host David Savva-Willett. Close to 5,800 delegates came through the doors this year, a record for the conference, and the pair reflect on what made it work: a program with a record number of speakers presenting for the first time, a deliberate focus on cyber while a global trend pulls conferences towards AI, and a community that turns up to share what it has learned. Michael also unpacks the AISA 2030 Vision and Strategy, unveiled at CyberCon. He explains how it was shaped through consultation with members, the vision of a digital world that is a safe place, and the five pillars that support it: leadership, impact, learning, engagement and resilience. He then walks through the horizons that take the association from today's baseline to 2030, and how members can have their say over the coming months. Cyber Voices is the official podcast of the Australian Information Security Association. Share your feedback at [email protected].

There was a pen on the table at a workshop. Placed next to an unlocked phone, it opened the browser and loaded the facilitator’s website, with nobody tapping anything and nobody agreeing to anything. David Hill was in the room, at the back, and what he noticed first was the noise. When the facilitator stopped to explain why people had started talking, the reaction arrived in two parts: delight at a clever piece of marketing kit, then unease at what it had just done without being asked. Recorded at AdelaideSEC, David joins David Savva-Willett to describe what happened next. He is an export adviser with the South Australian Department of State Development rather than a security practitioner, speaking here in a personal capacity, and he is open about how long he spent working out whether he was even entitled to take the pen apart, and what the right thing to do about it was. Taking it apart revealed an NFC tag under the sleeve at the top. It also revealed that the tag had been left writable, so anyone who pocketed one could change where it pointed. He worked out how to do that from a search engine and a free app, with no prior experience of either. The conversation covers why a workshop is precisely the room where your guard is lowest; why NFC has no equivalent of a Wi-Fi password, a Bluetooth PIN or the deliberate act of pointing a camera at a QR code; how cheaply programmable tags can be bought in bulk; and the finding he considers most important, which is that the phone most likely to react is the personal one nobody manages or trains anyone about. He also describes how he raised it with the facilitator, in the first break, as an attendee asking about informed consent rather than an expert catching someone out.

Information stealing malware is not new and not sophisticated. That is precisely what worries Jesse Hoppo, who leads the open source intelligence and cyber crime team within Telstra's Threat Research and Intelligence Group, and who spends a good deal of his time reading what these things send home. Recorded at AdelaideSEC, Jesse joins David Savva-Willett after his talk on what an organisation looks like through an info stealer's eyes. He explains how the malware arrives, usually by persuading someone to run a command themselves rather than through any exploit, and what a single log actually holds: browser credentials, session cookies, clipboard contents, search history, a screenshot of the desktop, whatever documents looked interesting. His central reframe is that the useful question is not what an attacker can do with a stolen password, but what they can do as that person. He also describes the browser password sync problem that quietly carries corporate credentials onto home machines, the exposure a single employee device can create, and the hardest question he has tried to answer for a large organisation: where are all the places your people can log in and access data? The conversation closes on what actually helps, for organisations and for individuals, including why he would rather you used any dedicated password manager than the one built into your browser.

Governance, risk and compliance generates a great deal of manual work, and not all of it is work anyone would miss. Ian Yip's argument is that this is exactly where AI earns its place in a security team, provided nobody mistakes it for judgment. Ian is the founder and CEO of Avertro, the company behind the cyber and AI governance platform CyberHQ, and he recently delivered a standing room only session on agentic GRC at Infosecurity Europe in London. He joins David Savva-Willett along with Jack Hedges, a strategic account executive at Avertro who works with security leaders across Australia. Ian sets out a way of thinking rather than a technology: build an agentic team the way you would build a human one, as an org chart of narrow specialists that collaborate, because models do their best work when given one task rather than many. Chained together and scheduled, that team absorbs the evidence collection, the framework crosswalks and the board reporting, leaving the humans the work they would rather be doing. What cannot be delegated is taste, which Ian describes as the ability to look at what a model hands back and know what to strip away. The conversation covers how much of GRC is theatre and which of that is still necessary for auditability, why he believes everyone is now a builder, what European regulators do differently and why their real effect is on budgets rather than behaviour, and Jack's view from the field, where a lack of visibility over what staff are already using has overtaken cyber GRC as the pressing concern.

Threat actors are already using large language models to accelerate the early stages of a compromise. Josh Lemon wanted to know what the same tools could do for the responders on the other side. Recorded at AdelaideSEC 2026, David Savva-Willett speaks with Josh Lemon, Chief of Digital Forensics and Incident Response at SoteriaSec and a SANS principal instructor, immediately after his talk on that question. Josh has been putting the major models in front of forensic evidence for years, and reports real movement: where they once sent an inexperienced analyst off in entirely the wrong direction, they now answer factual questions reliably. What they still lack is the creativity to ask why something is wrong, or what a threat actor is likely to do next. The discussion ranges across where LLMs are genuinely saving hours in a SOC, from one off Python tooling to threat intelligence summaries to executive status updates; a response Josh received that read unmistakably like vendor advertising; why he warns his students that an AI written report may one day be read by an expert witness in court; how MCP servers are being folded into SANS forensics classes; and whether any of this helps with the on call burden and burnout that have dogged the profession for years. It closes on the exchange every responder knows by heart, where no evidence of exfiltration gets heard as no exfiltration, and Josh's observation about what a model eager to please would say if a lawyer asked it the same question.

Most organisations still treat AI agents as software. Their staff do not. Agents are being used as colleagues, confidants and co-developers; they are being handed access to multiple systems, and a good number of them belong to proof-of-concept projects that quietly ended without anyone shutting off the credentials. Recorded at AdelaideSEC, David Savva-Willett speaks with Sharon Hunneybell, VP of Products at FirstWave, ahead of her talk on a governance framework for AI agents as workers. Sharon describes realising midway through writing that framework that she had missed a step, and that discovery has to come before onboarding, because these things arrive in the workplace unannounced and increasingly as features inside software that is already approved. The conversation covers where accountability sits when an agent acts, why access should be task-based and time-limited rather than granted to one broad agent, how far traditional HR frameworks actually translate, and what Sharon expects from regulation over the coming months. It closes on her practical checklist: give every agent its own identity, log what it does, scope its access to a single task, review it on a schedule, and know how to offboard it before you build it.

Quantum computers will one day break the cryptography that protects almost everything online. The harder questions are how much of the alarm is warranted, and what security leaders should be doing now. David Savva-Willett is joined by Geoff Schomburgk, Regional Vice President for Asia Pacific and Japan at Yubico, and Alex Wilson, who leads solutions engineering for the region. They unpack harvest now, decrypt later and how much of it is a device for grabbing attention; what it took to get post-quantum algorithms running on the secure element inside a YubiKey; and why crypto agility, not any single algorithm, is the thing to design for. The conversation turns to authentication, where passkeys are becoming the root of trust for digital wallets, mobile driver licences and financial transactions, and to the difference between device bound and copyable passkeys that many organisations have not thought through. Both guests make the case that this is a project management and governance problem rather than a technology one, and that the apocalyptic framing does more harm than good.

Recorded live at AISA SydneySec 2026, host David Savva-Willett is joined by Christine Ferguson, Inclusion Specialist Lead in DXC Technology's Social Impact Practice, where she leads the DXC Dandelion Program. Since 2014 the program has supported over 350 neurodivergent people into sustainable technology and cyber security careers across Australia, Europe, Asia and now the Middle East. Christine had just come off stage with her SydneySec session Neurodiversity in Cyber: People, Pressure and Performance, and the conversation follows the same three threads. What neurodivergent professionals bring to a cyber team that routinely gets overlooked. What pressure and masking actually feel like from the inside, and why an escalating manager and an escalating analyst never produce a good outcome. And what genuinely changes for a team, not just an individual, when a workplace gets the accommodations right. Christine speaks openly about her own dyslexia and about wearing the Hidden Disabilities Sunflower lanyard at the conference so that people could see an invisible disability made visible. She closes with the one small change she would ask of any leader listening, which turns out to cost nothing at all. Cyber Voices is the official podcast of the Australian Information Security Association. Share your feedback at [email protected].

Recorded live at AISA SydneySec 2026, host David Savva-Willett sits down with Nakshathra Suresh, a cyber criminologist and one of very few people in Australia bringing a social science lens to artificial intelligence and emerging technology safety. Nakshathra is co-founder of eiris, a safety technology consultancy, Oceania Youth Ambassador for the Internet Society, and teaches with the Faculty of Law and Justice at UNSW where she created the university's first criminology backed cyber security course. The conversation covers what a cyber criminologist actually does and why the discipline is still so young, how generative AI has turned catfishing and cyberstalking into something that runs itself once a public profile is scraped, the long tail of harm for victim survivors who end up retiring their online lives entirely, and why human centred resilience is a question of culture and conduct rather than another vulnerability to patch. Nakshathra also makes a direct case about who is missing from the room when security decisions get made. Content note: this episode includes discussion of cyberstalking, technology facilitated abuse, image based abuse and harm to children in online environments. If anything here raises something for you, support is available. 1800RESPECT on 1800 737 732 or Lifeline on 13 11 14, and image based abuse can be reported to the eSafety Commissioner at esafety.gov.au. Cyber Voices is the official podcast of the Australian Information Security Association. Share your feedback at [email protected].

Cybercrime is not a lone hacker in a hoodie any more. It is an economy, and by some estimates a staggeringly large one. In this episode of Cyber Voices, host David Savva-Willett flips the usual script and asks not how we defend, but how we fight back. Glenn Maiden is Chief Security Officer for Fortinet Australia and Director of Threat Intelligence at FortiGuard Labs for Australia and New Zealand. He spent years in Defence and the Australian Intelligence Community working in geospatial and human terrain intelligence, including during Operation Slipper, before moving into commercial threat intelligence. He established the team behind the World Economic Forum's Cybercrime Atlas and, most recently, helped create a first of its kind cybercrime bounty program with Crime Stoppers International. The conversation covers how mapping tribal structures, community leaders and wells in a conflict zone translates to mapping the humans behind ransomware crews, why our industry has become excellent at indicators of compromise and knows almost nothing about the actual people, and what the Cybercrime Atlas found when it started pulling names, aliases, bank accounts, crypto wallets and bulletproof hosting together into targeting packages for Interpol, Europol and the FBI. David and Glenn also dig into why better defence alone was never going to be enough, the gap that sits on the people and process side rather than the technology side, and the unreported soft underbelly of an economy built on small and medium business. Glenn explains how the new bounty program works, how someone with intelligence on a threat actor can submit an anonymous tip and potentially collect a reward when that person is arrested and prosecuted, and why the same infrastructure mapping may help pull far worse criminals off the streets. There is a human side too. Glenn talks about the young man in Eastern Europe committing cybercrime to get his family out, the scam compounds operating a couple of hours to Australia's north, and his own experience of being scammed through Facebook Marketplace. He explains why he tells that story publicly and how shame keeps victims silent. Glenn closes with practical advice for CISOs, SOC leads and analysts who will never run a takedown themselves. Content note: this episode includes brief references to human trafficking, forced labour in scam centres and child exploitation material in the context of organised crime. Cyber Voices is the official podcast of the Australian Information Security Association. Share your feedback at [email protected].

On this episode of Cyber Voices, host David Savva-Willett is at the tail end of Canberra CyberConnect 2026, AISA's first ever event in the nation's capital, sitting down with a guest who has one of the best job titles in Australian cyber. Ant Cohen is Head of Security Influence and Trust at nbn. Before cyber, he built some of the most recognisable marketing campaigns this country has seen, from Oprah's Australian adventure to 25 Wallabies campervans touring New Zealand during the Rugby World Cup to a gold medal winning campaign for the Australian Olympic and Paralympic teams in London. He now brings that storytelling firepower to human centred cyber defence, and sits on a NSW Crime Stoppers advisory committee. David and Ant get into why security awareness has a well earned reputation for being boring and occasionally condescending, and Ant's diagnosis of the problem: an oversupply of supply. The industry has indulged in training, drills and metrics reporting without ever building the demand. The idea that stops David in his tracks is the do nothing cohort. Security teams obsess over the people who click and celebrate the people who report, but the largest group by far is the people who open the simulation, leave it sitting in the inbox and take no action at all. Ant explains why the time of day, the device and the out of office setting tell you far more about your culture than a click rate ever will, and why he is a believer in small data over big data. The conversation also covers whether phishing simulations remain tenable after a decade of use, the difference between decisions made cold and decisions made in the heat of the moment, closing the loop so people know a human actually reads what they report, and the scale of nbn's responsibility given the proportion of Australia's daily data traffic that crosses the network. Ant's team of four works alongside nbn Local to reach regional and rural communities, libraries and the Country Women's Association with scams education aimed squarely at the Australians most often targeted. And his one thing for cyber leaders heading back to work on Monday: learn your audience, and learn the language they actually speak. Recorded live at Canberra CyberConnect 2026.

Every playbook and SOP you have ever written assumes it will be picked up by a calm, fully regulated human. My guest this episode reckons that assumption is exactly where incident response quietly falls apart. Recorded live at AISA's inaugural CyberConnect Canberra 2026 at the Hotel Realm, David Savva-Willett sat down with Darren Fleming, peak performance strategist, author, and the man better known as That Mindfulness Bloke. Darren represented Australia in elite sailing, studied psychology and philosophy at Oxford, has written seven books on communication, leadership and mindset, sat in complete silence for ten days, and spent more than twenty years coaching global organisations including Caterpillar, Cisco, BHP and Rio Tinto on how to perform under pressure. His CyberConnect talk, The Human Firewall, covers the thing no runbook touches: what actually happens to a responder's brain in the first hours of a Sev1. They get into why the nervous system, not the playbook, makes the decision. How adrenaline and cortisol cut off access to long term memory, and why "it made sense at the time" is a physiological answer rather than an excuse. The difference between situational awareness, stretched awareness and tunnel vision, and why "I just didn't see it" keeps turning up in the debrief. Why incident teams start turning on each other under pressure, and why that is the body working exactly as designed rather than a culture problem. What ten days of Vipassana taught Darren that a psychology degree could not. The collapse of the average attention span from roughly two and a half minutes to under a minute in twenty years. How a SANFL club lifted its win rate by changing what three senior players did during the half time break. And the one technique Darren would hand a CISO heading into a tabletop next week. Find out more about Darren's work at thatmindfulnessbloke.com Cyber Voices is the official podcast of the Australian Information Security Association. Subscribe wherever you get your podcasts and leave us a five star rating, it genuinely helps others find the show. Learn more about AISA or become a member at aisa.org.au

Most people arrive at the CISO chair from the outside. Graham Fairley did the opposite — he earned it from within. In this episode, host David Savva-Willett sits down with Graham Fairley, Chief Information Security Officer at PEXA (Property Exchange Australia), for a candid and personal conversation. Davey held the CISO role at PEXA before Graham, and the two have been friends and colleagues for the better part of a decade — which makes this a rare, honest look at what it actually takes to grow into one of the most demanding seats in Australian cyber. Graham progressed through identity and access management, security consulting and a security services lead role before stepping into the CISO chair in late 2024. Eighteen months in, he reflects on the learning curves nobody warns you about: winning executive and board buy-in, sitting with the weight of accountability, learning to let go of the technical work he loves, and becoming the kind of storyteller a modern security leader has to be. They also get into what PEXA actually protects — a platform underpinning Australia's ~$10 trillion property market and designated critical infrastructure — including the 6.5 million intrusion attempts PEXA blocked in a single financial year, four times the previous year's volume. Graham unpacks PEXA's layered defence approach, and the harder problem beyond the platform: the consumer. As he puts it, criminals don't need to compromise systems — they just need to compromise trust. In this episode: Why the "internal" route to CISO is undervalued — and the edge it gives youThe first 18 months in the chair, and the skills that sharpened fastestWhy every CISO has to be a storyteller (and where AI genuinely helps)Learning to step back so the team — not the CISO — becomes the heroDefending critical infrastructure at scale: layered controls, threat intel and speed-to-detectSocial licence, shared accountability and PEXA's Safeguarding Your Property Settlement white paperAI-supercharged business email compromise, and the "stop and think" habits that stop itReal advice for anyone who wants the CISO job one dayCyber Voices is the official podcast of the Australian Information Security Association (AISA). If you're enjoying the show, a five-star rating (about five seconds of your time) genuinely helps more people find it. Interested in sponsoring Cyber Voices or reaching the AISA community at CyberCon? Contact the AISA national events and sponsorship team via [email protected]. #CyberSecurity #CISO #AISA #CyberVoices #PEXA #CriticalInfrastructure #InfoSec #Leadership

On this episode of Cyber Voices, host David Savva-Willett is on the ground at Canberra CyberConnect 2026, AISA's inaugural event in the nation's capital, sitting down with Grant McKechnie for a conversation that CFOs and board members need to hear. Grant is Managing Partner at Cyber Resilience Group and a two-decade CISO veteran of Endeavour Group, Telstra and NBN. He was named one of the top 10 CISOs in Asia Pacific in 2022 and has built greenfield cyber security functions across some of Australia's most critical infrastructure. Today at CyberConnect he has returned with Breachonomics Redux, a follow up to the passion project he has been researching for the past four years on the untold economic and human impacts of a data breach. We get into the share price data behind major Australian and global breaches, from Medibank's 198 days back to parity to Live Nation's share price actually climbing after a breach affecting 560 million records. Grant unpacks why the market is becoming ambivalent, why Australian penalties never match the crime, and why trust and communications have overtaken share price as the impact he now leads with when advising boards. We also dig into how threat actors are adapting (including calling the regulators on their own victims), why information sharing has quietly gotten worse even as we appear to share more, the three critical first hires when building a cyber function from a blank page, the underrated art of finding a board sponsor before you need one, and the crucial difference between what belongs in an ARC pack versus a full board pack.  If you have a CFO or a board member in your life, this is the one to forward on